Draft 0.5: identity/registry spec; Phase A signed MA registry, mailbox challenge auth, key rotation, skew rejection

src/crypto.rs

@@ -97,6 +97,29 @@ fn write_canonical(value: &Value, out: &mut String) {
     }
 }
 
+pub fn poll_signing_bytes(member: &str, nonce: &str) -> Vec<u8> {
+    format!("{}\npoll\n{}\n{}", PROTOCOL, member, nonce).into_bytes()
+}
+
+pub fn verify_signature(public_hex: &str, message: &[u8], sig_hex: &str) -> Result<()> {
+    let key_bytes = hex::decode(public_hex).context("public key is not hex")?;
+    let key_bytes: [u8; 32] = key_bytes
+        .as_slice()
+        .try_into()
+        .map_err(|_| anyhow!("public key must be 32 bytes"))?;
+    let verifying_key =
+        VerifyingKey::from_bytes(&key_bytes).map_err(|e| anyhow!("bad public key: {e}"))?;
+    let sig_bytes = hex::decode(sig_hex).context("signature is not hex")?;
+    let sig_bytes: [u8; 64] = sig_bytes
+        .as_slice()
+        .try_into()
+        .map_err(|_| anyhow!("signature must be 64 bytes"))?;
+    let signature = Signature::from_bytes(&sig_bytes);
+    verifying_key
+        .verify_strict(message, &signature)
+        .map_err(|_| anyhow!("signature verification failed"))
+}
+
 pub fn signing_bytes(envelope: &Envelope) -> Vec<u8> {
     format!(
         "{}\n{}\n{}\n{}\n{}\n{}",
@@ -111,22 +134,7 @@ pub fn signing_bytes(envelope: &Envelope) -> Vec<u8> {
 }
 
 pub fn verify_envelope(envelope: &Envelope) -> Result<()> {
-    let key_bytes = hex::decode(&envelope.from).context("from is not hex")?;
-    let key_bytes: [u8; 32] = key_bytes
-        .as_slice()
-        .try_into()
-        .map_err(|_| anyhow!("from must be a 32-byte ed25519 public key"))?;
-    let verifying_key =
-        VerifyingKey::from_bytes(&key_bytes).map_err(|e| anyhow!("bad public key: {e}"))?;
-    let sig_bytes = hex::decode(&envelope.sig).context("sig is not hex")?;
-    let sig_bytes: [u8; 64] = sig_bytes
-        .as_slice()
-        .try_into()
-        .map_err(|_| anyhow!("sig must be 64 bytes"))?;
-    let signature = Signature::from_bytes(&sig_bytes);
-    verifying_key
-        .verify_strict(&signing_bytes(envelope), &signature)
-        .map_err(|_| anyhow!("signature verification failed"))
+    verify_signature(&envelope.from, &signing_bytes(envelope), &envelope.sig)
 }
 
 pub fn now_ts() -> u64 {